Open sourceIn the free reqad package (GPL-3.0).

Copy server settings

Setting up a second server, or moving to a new one? reqad settings writes the way a server is set up to one file - mail limits, blocklists, spam and virus checks, firewall options, login security, the panel's switches - and applies that file on a freshly installed Reqad server. It copies settings, not configuration files: each value goes through the same code that saves it in the panel, so the new server checks it and keeps its own hostname, addresses and certificates.

Settings only, never accounts. The file never holds the hostname, the server's IP addresses, its keys or anything of a hosting account. Accounts, sites, mailboxes and databases move with the Transfer Tool.

In short

On the old server, write the file:

reqad settings export --with-secrets --output=/root/settings.json

Copy it to the new server, see what would change, then apply it:

reqad settings import /root/settings.json --dry-run
reqad settings import /root/settings.json

Then delete the file on both servers: with --with-secrets it holds passwords and API keys. Running the import again changes nothing, so you can repeat it after a change on the old server.

What is copied

The settings come in groups. reqad settings groups lists them.

Group	What it holds
`reqad`	The panel's own settings: which features are on, panel login security (lockouts, session times, passkeys, email codes), the default shell and session limits of new accounts, the REST API and AI access switches, visitor stats and shell activity logging, the webmail link, automatic updates, where root's mail goes, backup exclusions, and the account panel's texts and featuresPremium.
`exim`	Exim's settings (sending limits, message size, TLS, ports, logging), the DNS blocklists, the sender domain check, the skip-RBL list and the virus scan mode.
`spamassassin`	SpamAssassin's settings, including the trusted and internal networks (the old server's own addresses are left out, the new server's are added).
`dovecot`	Dovecot's settings, full-text search and the server-wide mail filters.
`modsecurity`Premium	The web application firewall: mode, paranoia level and threshold, rules switched off, the rules for known exploits, your own rules and their data files, and the firewall blocking of repeated attackers. Install the add-on on the new server first, or this group is skipped.
`csf`	The firewall: the options in `csf.conf` and the entries of `csf.allow`, `csf.ignore` and `csf.pignore`.
`secrets`	Only with `--with-secrets`: the panel's sending method (SMTP server and login), the DNS provider and its token, and API keys (PageSpeed, AI assistant).
`backup`	Only with `--with-secrets`: the remote backup server. See below.

Not copied

The hostname, the server's IP addresses, its SSH and DKIM keys and its certificates.
Anything of a hosting account.
csf options that only fit the old server: its network interfaces, test mode, log file paths and its own keys.
The SSH keys the DNS provider or the remote backup log in with; the export says when one is set, so you can copy it by hand.
Debug switches of Dovecot.
Changes made by hand in the configuration files themselves. reqad settings diff shows them.
Hosting packages, the panel's IP allow list and PHP settings. Not yet.

Importing

--dry-run lists every setting that would change, with its value now and the new one, group by group, and changes nothing. Secrets show as hidden; for csf lists and port lists you see only what would be added. Pick groups with --only and --skip:

reqad settings import settings.json --only=exim,spamassassin
reqad settings import settings.json --skip=csf

The import works like saving each page in the panel:

Exim and Dovecot check the new configuration before they restart. When one refuses it, that group's old settings are put back and the import says why.
Port lists in csf.conf and the entries of csf.allow, csf.ignore and csf.pignore are merged: what the old server opens or lists is added, nothing the new server has is closed or removed. The old csf files are saved in /var/lib/reqad/settings-import/ first, and put back when csf does not start.
The server-wide mail filters are replaced by the old server's.
Full-text search can be turned on (it installs a package), not off.
Setting a sending method means admins without two-factor login get their login codes by mail.

Look at the dry run for entries that belonged to the old server's job, for example a csf.allow line that let another server reach a service only the old server runs. Remove those on the new server after the import.

Remote backup

The backup group is applied only when you name it: --only=backup. Two servers that back up to the same folder on the backup server delete each other's backups when old ones are rotated out. Give the new server its own folder, and add its SSH public key on the backup server.

DNS provider

When the old server runs its own PowerDNS, the DNS provider is not copied: the new server would point at itself. Keep its zones on the old server instead, with a DNS API key. A PowerDNS server on its own port gets that outgoing port opened in csf.

Hand edits

Changes made directly in exim.conf, Dovecot's local.conf or SpamAssassin's local.cf are not settings, so the import leaves them. To see them, compare the old server's files with the new one's:

reqad settings diff settings.json
reqad settings diff settings.json --config=exim

The file keeps copies of those three files only for this comparison, with the hostname, the server's addresses and passwords masked on both sides.

An older server

reqad settings comes with Reqad 1.0.51. To export from a server with an older version, run the new server's copy of the tool there over SSH. On the new server:

ssh root@old.example.com \
  '/opt/reqad/php-current/usr/bin/php \
   -c /etc/reqad/php-fpm/php.ini -- export --with-secrets' \
  < /usr/local/reqad/scripts/server_settings.php \
  > /root/settings.json
chmod 600 /root/settings.json

The tool only reads on the old server; nothing is installed or changed there.

Options

reqad settings export [--with-secrets] [--output=FILE]
reqad settings import FILE [--dry-run] [--only=GROUPS]
                           [--skip=GROUPS]
reqad settings diff   FILE [--config=exim|dovecot|spamassassin]
reqad settings groups

Without --output the file goes to standard output; with it, the file is readable by root only. Add --json for a machine-readable result. More commands on the command line page.

Need a hand? Create a free account or contact us.